Andro-CD

Pull-based GitOps for AWS ECS — the ArgoCD model (watch Git → diff → reconcile), applied to ECS services, task definitions, scheduled tasks and clusters. One Docker image, a React dashboard, and your manifests in Git as the single source of truth.

Get started View on GitHub

---

• GitOps reconciliation

  ---

  Polls your repos (or reacts to webhooks), diffs desired vs live AWS state and applies the difference — with sync waves, pre/post-sync hooks, self-heal and safe pruning.

• Argo-style dashboard

  ---

  Sync & health per app, side-by-side diff, live CloudWatch logs (SSE), task forensics, one-click sync/rollback/prune, dark mode, URL-shareable filters.

• Four kinds

  ---

  ECSService, ECSScheduledTask (EventBridge cron), ECSServiceSet (app-of-apps generators) and ECSCluster — the cluster itself managed from Git.

• Production-grade security

  ---

  GitHub OAuth + RBAC, API tokens for CI, audit log, CSP/CSRF/rate limits, encrypted multi-account AWS profiles, non-root container.

• Cost-aware deployments

  ---

  Fargate Spot capacity provider strategies, target-tracking autoscaling, labels propagated to AWS tags for cost allocation, task-definition cleanup.

• Built for operations

  ---

  HA leader election, dry-run mode, sync windows (deploy freeze), Prometheus metrics, Slack notifications, readiness probes, values-file templating.

How it works

graph LR
  G[Git repos<br/>YAML manifests] -->|poll / webhook| E[Andro-CD]
  E -->|diff| A[AWS ECS<br/>clusters · services · task defs]
  E -->|apply when OutOfSync| A
  U[React UI + API + CLI] --> E

1. Connect one or more Git repositories from the UI (HTTPS token, SSH key or GitHub App).
2. Push YAML manifests — Andro-CD validates, diffs and (auto-)syncs them to AWS.
3. Watch sync status, health, diffs and logs in the dashboard; roll back with one click.

A manifest in 20 lines

apiVersion: andro-cd/v1
kind: ECSService
metadata:
  name: web-app
  labels: {team: platform}
spec:
  region: eu-central-1
  cluster: production
  service:
    desiredCount: 2
    launchType: FARGATE
  network:
    subnets: [subnet-aaa, subnet-bbb]
    securityGroups: [sg-0123]
  taskDefinition:
    containers:
      - name: web
        image: nginx:1.27
        portMappings: [80]
        logGroup: /ecs/web-app

That's a running, monitored, drift-detected ECS service. Everything else — autoscaling, load balancers, Spot, hooks, health checks — is opt-in.

Read the manifest reference →